Extracted

• • Target
    e797b1b0c84fe3048dafaffd762960ebe2d38be2f3920114948a1c84d15db7cd
  • Size 45KB
  • SHA256 e797b1b0c84fe3048dafaffd762960ebe2d38be2f3920114948a1c84d15db7cd
  • MD5 cf5b3762daee5a16161b6109e1bd04f0
  • SHA1 720f2ca2f68f61aec67748602f82dc810f020ac3
  • SHA512 4ca844e0e6825ed83dcd75ba509bec738cc388847b5c36e63e8fe42fcbdafb250364d82e6565530ab8ac09cb0460dd1a629a64808837d7f66ff8c1f1c22a1933
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlLlsHoPEaMPIGLjbwgX3iS3azV3qFMm7W8XtHBDo:wuDWZTpMZSB2OuuEaxGfb3XSS3E91m7g
  • TLSH
    T1C5231A003BE8822BF2BE4F789DF26245467EF5732603D5491CC4519B5713FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2